mayar-v2
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill utilizes
npx -y mayar@latestto dynamically download and execute the Mayar CLI tool directly from the npm registry during setup and documentation retrieval. - [EXTERNAL_DOWNLOADS]: The skill interacts with external API endpoints at
api.mayar.idandapi.mayar.clubfor payment processing and verification tasks. - [COMMAND_EXECUTION]: The agent is instructed to run local shell commands using the
mayarCLI to verify merchant identity, set API keys, and manage webhooks. - [DATA_EXFILTRATION]: The skill identifies an indirect prompt injection surface during project reconnaissance.
- Ingestion points: The agent reads project configuration files such as
package.json,composer.json, andrequirements.txt, and identifies the names of environment variables in.envfiles. - Boundary markers: No specific boundary markers or instructions to ignore embedded commands are present.
- Capability inventory: The agent has the capability to write files, execute shell commands via
npx, and perform network operations. - Sanitization: No sanitization of ingested project metadata is performed.
- [COMMAND_EXECUTION]: The skill generates and writes integration code files and modifies existing project configuration files (e.g.,
.env,.gitignore) to implement the payment flow.
Audit Metadata